{"id":"CVE-2026-97687","aliases":["ALSA-2026:84577","ALSA-2026:84578","ALSA-2026:85929","ALSA-2026:85930","ALSA-2026:90494","ALSA-2026:92474","AZL-105651","AZL-105663","AZL-105678","AZL-105693","AZL-105909","BELL-CVE-2026-97687","CLSA-2026-1790834041","CLSA-2026-1790847237","CLSA-2026-1791264856","CLSA-2026-1791270635","DEBIAN-CVE-2026-97687","EUVD-2026-89000","GHSA-8988-9cw3-xx77","OESA-2026-4624","OESA-2026-4625","OESA-2026-4626","OESA-2026-4627","PYSEC-2026-4175","RHSA-2026:69612","RHSA-2026:84577","RHSA-2026:84578","RLSA-2026:84577","RLSA-2026:84578","RLSA-2026:85929","RLSA-2026:85930","RLSA-2026:90494","RLSA-2026:92474","SUSE-SU-2026:24125-1","SUSE-SU-2026:24217-1","SUSE-SU-2026:4704-1","SUSE-SU-2026:4948-1","UBUNTU-CVE-2026-97687","USN-8926-1","openSUSE-SU-2026:12044-1","openSUSE-SU-2026:12119-1","openSUSE-SU-2026:22071-1","openSUSE-SU-2026:22252-1"],"status":"published","title":"urllib3: HTTPS proxy TLS configuration may be ignored or overridden","description":"urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.","severity":{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00206,"percentile":0.10748,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295","CWE-440"],"published":"2026-09-29T15:30:27Z","modified":"2026-11-11T17:27:05Z","fixes":[{"ecosystem":"PyPI","package":"urllib3","fixed_in":["2.8.0"],"sources":["ghsa","osv"]},{"ecosystem":"Alpaquita:stream","package":"py3-urllib3","fixed_in":["2.8.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-urllib3","fixed_in":["2.8.0-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"python-urllib3","fixed_in":["1.26.18-11.oe2403sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"python-urllib3","fixed_in":["1.26.18-11.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"python-urllib3","fixed_in":["1.26.18-11.oe2403sp3"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"python-urllib3","fixed_in":["2.6.3-1ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.26.0"},{"fixed":"2.8.0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3.14-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-2.el9_8.6"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3.14-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-2.el10_2.6"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3.12-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.19-3.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"python3-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.19-4.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.5-8.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3.12-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.19-5.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"24.2-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.7-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-virtualenv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"20.36.1-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.12.14-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"tensorflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.16.1-11"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"py3-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.26.12-r1"},{"fixed":"2.8.0-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.7"},{"fixed":"2.0.7.post4+tuxcare"}]}],"versions":["2.0.7","2.0.7.post1+tuxcare","2.0.7.post2+tuxcare","2.0.7.post3+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.26.20"},{"fixed":"1.26.20.post5+tuxcare"}]}],"versions":["1.26.20","1.26.20.post1+tuxcare","1.26.20.post2+tuxcare","1.26.20.post3+tuxcare","1.26.20.post4+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.26.4"},{"fixed":"1.26.4.post6+tuxcare"}]}],"versions":["1.26.4","1.26.4.post1+tuxcare","1.26.4.post2+tuxcare","1.26.4.post3+tuxcare","1.26.4.post4+tuxcare","1.26.4.post5+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.0.post2+tuxcare"}]}],"versions":["2.5.0","2.5.0.post1+tuxcare"],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.12-1","1.26.12-1+deb12u1","1.26.12-1+deb12u2","1.26.12-1+deb12u3","1.26.12-1+deb12u4","1.26.16-1","1.26.17-1","1.26.18-1","1.26.18-2","2.0.7-1","2.0.7-2","2.2.3-1","2.2.3-2","2.2.3-3","2.2.3-4","2.3.0-1","2.3.0-2","2.3.0-3","2.5.0-1","2.5.0-1.1","2.5.0-2","2.6.3-1","2.6.3-2","2.7.0-1","2.7.0-2","2.7.0-3","2.8.0-1","2.8.0-2"]},{"source":"osv","ecosystem":"Debian:13","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.0-3","2.3.0-3+deb13u1","2.3.0-3+deb13u2","2.5.0-1","2.5.0-1.1","2.5.0-2","2.6.3-1","2.6.3-2","2.7.0-1","2.7.0-2","2.7.0-3","2.8.0-1","2.8.0-2"]},{"source":"osv","ecosystem":"Debian:14","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.0-1"}]}],"versions":["2.3.0-3","2.5.0-1","2.5.0-1.1","2.5.0-2","2.6.3-1","2.6.3-2","2.7.0-1","2.7.0-2","2.7.0-3"]},{"source":"osv","ecosystem":"PyPI","package":"urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.26.0"},{"fixed":"2.8.0"}]}],"versions":["1.26.0","1.26.1","1.26.10","1.26.11","1.26.12","1.26.13","1.26.14","1.26.15","1.26.16","1.26.17","1.26.18","1.26.19","1.26.2","1.26.20","1.26.3","1.26.4","1.26.5","1.26.6","1.26.7","1.26.8","1.26.9","2.0.0","2.0.0a1","2.0.0a2","2.0.0a3","2.0.0a4","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.1.0","2.2.0","2.2.1","2.2.2","2.2.3","2.3.0","2.4.0","2.5.0","2.6.0","2.6.1","2.6.2","2.6.3","2.7.0"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.18-11.oe2403sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.12-16.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.18-11.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.18-11.oe2403sp3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.26.0"},{"fixed":"2.8.0"}]}],"versions":["1.26.0","1.26.1","1.26.10","1.26.11","1.26.12","1.26.13","1.26.14","1.26.15","1.26.16","1.26.17","1.26.18","1.26.19","1.26.2","1.26.20","1.26.3","1.26.4","1.26.5","1.26.6","1.26.7","1.26.8","1.26.9","2.0.0","2.0.0a1","2.0.0a2","2.0.0a3","2.0.0a4","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.1.0","2.2.0","2.2.1","2.2.2","2.2.3","2.3.0","2.4.0","2.5.0","2.6.0","2.6.1","2.6.2","2.6.3","2.7.0"]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.0-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-urllib3+brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.0-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-urllib3+h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.0-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-urllib3+socks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.0-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-urllib3+zstd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.0-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"python3-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.0-1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3.14-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.3-2.el9_8.6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"python3.14-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.3-2.el10_2.6"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"python3.14-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.3-2.el9_8.6"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"python3.14-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.3-2.el10_2.6"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"python3.12-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.19-3.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.19-4.el10_2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.5-8.el9_8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"python3.12-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.19-5.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-160000.8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-160000.8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-160000.8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-150400.7.36.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-150400.7.36.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-150400.7.36.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-150400.7.36.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-150400.7.36.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-150400.7.36.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-150400.7.36.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-150400.7.36.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-150400.7.36.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-150400.7.36.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-150400.7.36.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-150400.7.36.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-urllib3_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.18-150600.3.14.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python-urllib3_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.18-150600.3.14.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python-urllib3_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.18-150600.3.14.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.1-2","1.5.4-1","1.5.4-1ubuntu1","1.5.4-1ubuntu3","1.5.4-1ubuntu4","1.5.4-1ubuntu4+esm1","1.5.4-1ubuntu4+esm2","1.5.4-1ubuntu4+esm3","1.5.4-1ubuntu4+esm4","1.5.4-1ubuntu4+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.6-7ubuntu1","1.5.6-7ubuntu2","8.0.2-7","8.0.3-1","8.0.3-2","8.1.0-1","8.1.0-2","8.1.1-1","8.1.1-2","8.1.1-2ubuntu0.1","8.1.1-2ubuntu0.2","8.1.1-2ubuntu0.4","8.1.1-2ubuntu0.6","8.1.1-2ubuntu0.6+esm2","8.1.1-2ubuntu0.6+esm3","8.1.1-2ubuntu0.6+esm4","8.1.1-2ubuntu0.6+esm5","8.1.1-2ubuntu0.6+esm6","8.1.1-2ubuntu0.6+esm8","8.1.1-2ubuntu0.6+esm10","8.1.1-2ubuntu0.6+esm11","8.1.1-2ubuntu0.6+esm12"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.0.1-2","9.0.1-2.3~ubuntu1","9.0.1-2.3~ubuntu1.18.04.1","9.0.1-2.3~ubuntu1.18.04.2","9.0.1-2.3~ubuntu1.18.04.3","9.0.1-2.3~ubuntu1.18.04.4","9.0.1-2.3~ubuntu1.18.04.5","9.0.1-2.3~ubuntu1.18.04.5+esm2","9.0.1-2.3~ubuntu1.18.04.5+esm3","9.0.1-2.3~ubuntu1.18.04.6","9.0.1-2.3~ubuntu1.18.04.6+esm1","9.0.1-2.3~ubuntu1.18.04.7","9.0.1-2.3~ubuntu1.18.04.7+esm1","9.0.1-2.3~ubuntu1.18.04.8","9.0.1-2.3~ubuntu1.18.04.8+esm1","9.0.1-2.3~ubuntu1.18.04.8+esm2","9.0.1-2.3~ubuntu1.18.04.8+esm4","9.0.1-2.3~ubuntu1.18.04.8+esm6","9.0.1-2.3~ubuntu1.18.04.8+esm7","9.0.1-2.3~ubuntu1.18.04.8+esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["18.1-5","18.1-5build1","18.1-5ubuntu1","20.0.2-2","20.0.2-4","20.0.2-5","20.0.2-5ubuntu1","20.0.2-5ubuntu1.1","20.0.2-5ubuntu1.3","20.0.2-5ubuntu1.4","20.0.2-5ubuntu1.5","20.0.2-5ubuntu1.6","20.0.2-5ubuntu1.7","20.0.2-5ubuntu1.8","20.0.2-5ubuntu1.9","20.0.2-5ubuntu1.10","20.0.2-5ubuntu1.10+esm2","20.0.2-5ubuntu1.11","20.0.2-5ubuntu1.11+esm2","20.0.2-5ubuntu1.11+esm3","20.0.2-5ubuntu1.11+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.5-1~exp1","1.26.5-1~exp1ubuntu0.1","1.26.5-1~exp1ubuntu0.2","1.26.5-1~exp1ubuntu0.3","1.26.5-1~exp1ubuntu0.4","1.26.5-1~exp1ubuntu0.5","1.26.5-1~exp1ubuntu0.6","1.26.5-1~exp1ubuntu0.7","1.26.5-1~exp1ubuntu0.8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.3.4-4","21.3.1+dfsg-3","22.0.2+dfsg-1","22.0.2+dfsg-1ubuntu0.1","22.0.2+dfsg-1ubuntu0.2","22.0.2+dfsg-1ubuntu0.3","22.0.2+dfsg-1ubuntu0.4","22.0.2+dfsg-1ubuntu0.5","22.0.2+dfsg-1ubuntu0.6","22.0.2+dfsg-1ubuntu0.7","22.0.2+dfsg-1ubuntu0.7+esm1","22.0.2+dfsg-1ubuntu0.7+esm2","22.0.2+dfsg-1ubuntu0.7+esm3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.16-1","1.26.18-1","2.0.7-1","2.0.7-1ubuntu0.1","2.0.7-1ubuntu0.2","2.0.7-1ubuntu0.3","2.0.7-1ubuntu0.4","2.0.7-1ubuntu0.5","2.0.7-1ubuntu0.6","2.0.7-1ubuntu0.7","2.0.7-1ubuntu0.8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["23.2+dfsg-1","23.3+dfsg-1","24.0+dfsg-1","24.0+dfsg-1ubuntu1","24.0+dfsg-1ubuntu1.1","24.0+dfsg-1ubuntu1.2","24.0+dfsg-1ubuntu1.3","24.0+dfsg-1ubuntu1.3+esm1","24.0+dfsg-1ubuntu1.3+esm2","24.0+dfsg-1ubuntu1.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["25.1.1+dfsg-1ubuntu2","26.1.2+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-1ubuntu1.2"}]}],"versions":["2.3.0-3","2.5.0-1","2.5.0-1ubuntu1","2.5.0-1ubuntu2","2.6.3-1ubuntu1","2.6.3-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["25.1.1+dfsg-1ubuntu2","25.1.1+dfsg-1ubuntu2+esm1","25.1.1+dfsg-1ubuntu2+esm2","25.1.1+dfsg-1ubuntu2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22-1ubuntu0.18.04.2+esm5"}]}],"versions":["1.21.1-1","1.22-1","1.22-1ubuntu0.18.04.1","1.22-1ubuntu0.18.04.2","1.22-1ubuntu0.18.04.2+esm1","1.22-1ubuntu0.18.04.2+esm2","1.22-1ubuntu0.18.04.2+esm3","1.22-1ubuntu0.18.04.2+esm4"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.8-2ubuntu0.4+esm6"}]}],"versions":["1.24.1-1ubuntu1","1.24.1-1ubuntu2","1.25.8-1","1.25.8-2","1.25.8-2ubuntu0.1","1.25.8-2ubuntu0.2","1.25.8-2ubuntu0.3","1.25.8-2ubuntu0.4","1.25.8-2ubuntu0.4+esm1","1.25.8-2ubuntu0.4+esm2","1.25.8-2ubuntu0.4+esm3","1.25.8-2ubuntu0.4+esm4","1.25.8-2ubuntu0.4+esm5"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.5-1~exp1ubuntu0.8"}]}],"versions":["1.26.5-1~exp1","1.26.5-1~exp1ubuntu0.1","1.26.5-1~exp1ubuntu0.2","1.26.5-1~exp1ubuntu0.3","1.26.5-1~exp1ubuntu0.4","1.26.5-1~exp1ubuntu0.5","1.26.5-1~exp1ubuntu0.6","1.26.5-1~exp1ubuntu0.7"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-1ubuntu0.8"}]}],"versions":["1.26.16-1","1.26.18-1","2.0.7-1","2.0.7-1ubuntu0.1","2.0.7-1ubuntu0.2","2.0.7-1ubuntu0.3","2.0.7-1ubuntu0.4","2.0.7-1ubuntu0.5","2.0.7-1ubuntu0.6","2.0.7-1ubuntu0.7"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-1ubuntu1.2"}]}],"versions":["2.3.0-3","2.5.0-1","2.5.0-1ubuntu1","2.5.0-1ubuntu2","2.6.3-1ubuntu1","2.6.3-1ubuntu1.1"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.0-1.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-urllib3_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.20-8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-160000.8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-urllib3_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.20-160000.5.1"}]}],"bundled":3}],"products":[{"vendor":"python","product":"urllib3"},{"vendor":"urllib3","product":"urllib3"}],"references":[{"url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","article","report"]},{"url":"https://github.com/urllib3/urllib3/pull/5093","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web","article","report"]},{"url":"https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465","tags":["x_refsource_MISC","Patch","fix","web","article","report"]},{"url":"https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3","tags":["x_refsource_MISC","Patch","fix","web","article","report"]},{"url":"https://github.com/urllib3/urllib3/releases/tag/2.8.0","tags":["x_refsource_MISC","Release Notes","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97687","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-8988-9cw3-xx77","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:84577","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-97687","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-97689","tags":["report"]},{"url":"https://bugzilla.redhat.com/2543245","tags":["report"]},{"url":"https://bugzilla.redhat.com/2543255","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-84577.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:84578","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-84578.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:85929","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-85929.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:85930","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-85930.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:90494","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-90494.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:92474","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-92474.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-97687","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97687.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-97687","tags":["advisory"]},{"url":"https://github.com/urllib3/urllib3","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4624","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4625","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97689","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4626","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4627","tags":["advisory"]},{"url":"https://pypi.org/project/urllib3","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69612","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-97688","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69612.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543255","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-97687","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543253","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-97688","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97688","tags":["advisory"]},{"url":"https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f","tags":["article"]},{"url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543245","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-97689","tags":["advisory"]},{"url":"https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed","tags":["article"]},{"url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84577.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84578.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:84577","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:84578","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:85929","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:85930","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:90494","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:92474","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624125-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1283908","tags":["report"]},{"url":"https://bugzilla.suse.com/1283909","tags":["report"]},{"url":"https://bugzilla.suse.com/1283910","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97689","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624217-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264704-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264948-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-97687","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8926-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-97688","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97689","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-43804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-37891","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-97687","title":"urllib3: HTTPS proxy TLS configuration may be ignored or overridden","description":"urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.","status":"published","published":"2026-09-29T15:30:27.136Z","modified":"2026-09-30T20:11:09.721Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-295","CWE-440"],"updated_at":"2026-11-02T13:44:07.200604Z"}],"euvd":[{"id":"EUVD-2026-89000","description":"urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.","status":"published","published":"2026-09-29T15:30:27Z","modified":"2026-09-30T20:11:09Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:27:47.293232Z"}],"ghsa":[{"id":"GHSA-8988-9cw3-xx77","title":"urllib3: HTTPS proxy TLS configuration may be ignored or overridden","description":"## Impact\n\nurllib3 supports configuring TLS independently for an HTTPS proxy and the target server.\n\n`proxy_ssl_context`, `proxy_assert_hostname`, and `proxy_assert_fingerprint` configure the TLS connection to the proxy. `ssl_context` and the other target-specific TLS parameters configure the connection to the target server.\n\nIn urllib3 versions 1.26.0 through 2.7.0, these configurations were not consistently separated. Depending on the proxy mode, urllib3 could:\n\n1. Ignore `proxy_ssl_context` and use the target server's SSL context for the TLS connection to an HTTPS forwarding proxy.\n2. Override the HTTPS proxy's certificate-verification policy with the target server's certificate-verification policy.\n3. Apply target-specific SNI, hostname assertions, certificate fingerprint assertions, or TLS client credentials to the TLS connection to an HTTPS forwarding proxy.\n\nIn particular, configuring `cert_reqs=\"CERT_NONE\"` for a target server could overwrite the `verify_mode` of the SSL context configured for the HTTPS proxy. This modification occurred in place and persisted on the context object, potentially disabling proxy certificate verification for later connections that reused the same context.\n\nAn attacker able to intercept the connection to an HTTPS proxy may be able to impersonate the proxy when the effective proxy TLS configuration disables certificate verification or otherwise accepts the attacker's certificate. This may occur, for example, when the target server's trust or identity policy is incorrectly applied to the proxy connection.\n\nWhen HTTPS forwarding is enabled, an impersonated proxy can observe or modify forwarded requests and responses, potentially exposing credentials, authentication tokens, request bodies, response data, and other sensitive information.\n\nA TLS client certificate intended for the target server may also be presented to the proxy or to an attacker impersonating it. This can disclose the client's identity and provide proof of possession of the corresponding private key. The private key itself is not transmitted during the TLS handshake.\n\nIn CONNECT tunneling mode, impersonating the HTTPS proxy does not by itself defeat the separate end-to-end TLS connection between the client and the target server.\n\n## Affected Usages\n\nCode using urllib3 versions 1.26.0 through 2.7.0 may be affected in any of the following cases.\n\n### 1. The target SSL context is used for an HTTPS forwarding proxy\n\nHTTPS requests are forwarded through an HTTPS proxy with `use_forwarding_for_https=True`, and `proxy_ssl_context` is configured for the proxy.\n\nurllib3 may ignore `proxy_ssl_context` and use the target server's `ssl_context` for the proxy TLS handshake. The proxy may therefore be verified using the target server's trust and certificate policy instead of the policy explicitly configured for the proxy.\n\n### 2. The target verification policy overrides the proxy policy\n\nAn HTTPS proxy is configured with `proxy_ssl_context`, while the target server uses a different certificate-verification policy.\n\nurllib3 may apply the target server's `cert_reqs` value to the proxy SSL context. For example, setting `cert_reqs=\"CERT_NONE\"` for the target server may also disable certificate verification for the HTTPS proxy, even when `proxy_ssl_context` was configured to require verification.\n\nThis issue can affect the TLS connection to an HTTPS proxy in both forwarding and CONNECT tunneling configurations.\n\n### 3. A mutated proxy SSL context is reused\n\nThe same SSL context is reused as `proxy_ssl_context` across multiple connections, and certificate verification is disabled for one target server.\n\nurllib3 may modify the proxy SSL context's `verify_mode` in place. Later connections that reuse the same context may therefore connect to the HTTPS proxy without certificate verification.\n\n### 4. Target-specific TLS identity or credentials are applied to the proxy\n\nHTTPS requests are forwarded through an HTTPS proxy with `use_forwarding_for_https=True`, and target-specific SNI, hostname assertions, certificate fingerprint assertions, or TLS client credentials are configured.\n\nurllib3 may apply these target-specific settings to the proxy TLS handshake. This may cause urllib3 to:\n\n- send SNI intended for the target server to the proxy;\n- verify the proxy using a hostname or certificate fingerprint intended for the target server; or\n- present a TLS client certificate intended for the target server to the proxy.\n\nCode connecting through a plain HTTP proxy does not establish a TLS connection to the proxy and is not affected by this issue.\n\n## Remediation\n\nUpgrade to urllib3 2.8.0 or later.\n\nurllib3 2.8.0 independently applies the explicitly configured `proxy_ssl_context` and proxy-specific certificate assertions to the HTTPS proxy connection. Target-specific SNI, certificate assertions, and TLS client certificate parameters are no longer applied to the HTTPS proxy handshake.\n\nFor backward compatibility, when an HTTPS proxy is used with `use_forwarding_for_https=True` and `proxy_ssl_context` is not provided, urllib3 2.8.0 continues to use `ssl_context` for the TLS connection to the proxy. This configuration emits a `FutureWarning`. In urllib3 3.0, passing `ssl_context` with `use_forwarding_for_https=True` for an HTTPS proxy will raise an error. Applications should use `proxy_ssl_context` to configure TLS for an HTTPS forwarding proxy.\n\nThe fixes were implemented in commits b6447295fff7b38fdffc67e0df9712d60cef3cc3 and 07408cec79d1856d81bb42c74a904a24fdb9e465.","status":"published","published":"2026-09-30T14:46:04Z","modified":"2026-09-30T14:46:05Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-295","CWE-440"],"updated_at":"2026-11-02T14:41:23.783773Z"}],"nvd":[{"id":"CVE-2026-97687","description":"urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.","status":"published","published":"2026-09-29T16:17:18.517Z","modified":"2026-10-13T20:27:23.13Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-295","CWE-440"],"updated_at":"2026-11-02T14:12:52.413234Z"}],"osv":[{"id":"BELL-CVE-2026-97687","status":"published","published":"2026-10-02T06:06:45.411653Z","modified":"2026-10-15T07:15:04.058121015Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:27.468539Z"},{"id":"CVE-2026-97687","title":"urllib3: HTTPS proxy TLS configuration may be ignored or overridden","description":"urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.","status":"published","published":"2026-09-29T15:30:27.136Z","modified":"2026-11-11T17:27:05.613013431Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-295","CWE-440"],"updated_at":"2026-11-11T17:46:38.239173Z"},{"id":"DEBIAN-CVE-2026-97687","description":"urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.","status":"published","published":"2026-09-29T16:17:18.517Z","modified":"2026-10-14T10:00:41.955694605Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:46:07.756422Z"},{"id":"GHSA-8988-9cw3-xx77","title":"urllib3: HTTPS proxy TLS configuration may be ignored or overridden","description":"## Impact\n\nurllib3 supports configuring TLS independently for an HTTPS proxy and the target server.\n\n`proxy_ssl_context`, `proxy_assert_hostname`, and `proxy_assert_fingerprint` configure the TLS connection to the proxy. `ssl_context` and the other target-specific TLS parameters configure the connection to the target server.\n\nIn urllib3 versions 1.26.0 through 2.7.0, these configurations were not consistently separated. Depending on the proxy mode, urllib3 could:\n\n1. Ignore `proxy_ssl_context` and use the target server's SSL context for the TLS connection to an HTTPS forwarding proxy.\n2. Override the HTTPS proxy's certificate-verification policy with the target server's certificate-verification policy.\n3. Apply target-specific SNI, hostname assertions, certificate fingerprint assertions, or TLS client credentials to the TLS connection to an HTTPS forwarding proxy.\n\nIn particular, configuring `cert_reqs=\"CERT_NONE\"` for a target server could overwrite the `verify_mode` of the SSL context configured for the HTTPS proxy. This modification occurred in place and persisted on the context object, potentially disabling proxy certificate verification for later connections that reused the same context.\n\nAn attacker able to intercept the connection to an HTTPS proxy may be able to impersonate the proxy when the effective proxy TLS configuration disables certificate verification or otherwise accepts the attacker's certificate. This may occur, for example, when the target server's trust or identity policy is incorrectly applied to the proxy connection.\n\nWhen HTTPS forwarding is enabled, an impersonated proxy can observe or modify forwarded requests and responses, potentially exposing credentials, authentication tokens, request bodies, response data, and other sensitive information.\n\nA TLS client certificate intended for the target server may also be presented to the proxy or to an attacker impersonating it. This can disclose the client's identity and provide proof of possession of the corresponding private key. The private key itself is not transmitted during the TLS handshake.\n\nIn CONNECT tunneling mode, impersonating the HTTPS proxy does not by itself defeat the separate end-to-end TLS connection between the client and the target server.\n\n## Affected Usages\n\nCode using urllib3 versions 1.26.0 through 2.7.0 may be affected in any of the following cases.\n\n### 1. The target SSL context is used for an HTTPS forwarding proxy\n\nHTTPS requests are forwarded through an HTTPS proxy with `use_forwarding_for_https=True`, and `proxy_ssl_context` is configured for the proxy.\n\nurllib3 may ignore `proxy_ssl_context` and use the target server's `ssl_context` for the proxy TLS handshake. The proxy may therefore be verified using the target server's trust and certificate policy instead of the policy explicitly configured for the proxy.\n\n### 2. The target verification policy overrides the proxy policy\n\nAn HTTPS proxy is configured with `proxy_ssl_context`, while the target server uses a different certificate-verification policy.\n\nurllib3 may apply the target server's `cert_reqs` value to the proxy SSL context. For example, setting `cert_reqs=\"CERT_NONE\"` for the target server may also disable certificate verification for the HTTPS proxy, even when `proxy_ssl_context` was configured to require verification.\n\nThis issue can affect the TLS connection to an HTTPS proxy in both forwarding and CONNECT tunneling configurations.\n\n### 3. A mutated proxy SSL context is reused\n\nThe same SSL context is reused as `proxy_ssl_context` across multiple connections, and certificate verification is disabled for one target server.\n\nurllib3 may modify the proxy SSL context's `verify_mode` in place. Later connections that reuse the same context may therefore connect to the HTTPS proxy without certificate verification.\n\n### 4. Target-specific TLS identity or credentials are applied to the proxy\n\nHTTPS requests are forwarded through an HTTPS proxy with `use_forwarding_for_https=True`, and target-specific SNI, hostname assertions, certificate fingerprint assertions, or TLS client credentials are configured.\n\nurllib3 may apply these target-specific settings to the proxy TLS handshake. This may cause urllib3 to:\n\n- send SNI intended for the target server to the proxy;\n- verify the proxy using a hostname or certificate fingerprint intended for the target server; or\n- present a TLS client certificate intended for the target server to the proxy.\n\nCode connecting through a plain HTTP proxy does not establish a TLS connection to the proxy and is not affected by this issue.\n\n## Remediation\n\nUpgrade to urllib3 2.8.0 or later.\n\nurllib3 2.8.0 independently applies the explicitly configured `proxy_ssl_context` and proxy-specific certificate assertions to the HTTPS proxy connection. Target-specific SNI, certificate assertions, and TLS client certificate parameters are no longer applied to the HTTPS proxy handshake.\n\nFor backward compatibility, when an HTTPS proxy is used with `use_forwarding_for_https=True` and `proxy_ssl_context` is not provided, urllib3 2.8.0 continues to use `ssl_context` for the TLS connection to the proxy. This configuration emits a `FutureWarning`. In urllib3 3.0, passing `ssl_context` with `use_forwarding_for_https=True` for an HTTPS proxy will raise an error. Applications should use `proxy_ssl_context` to configure TLS for an HTTPS forwarding proxy.\n\nThe fixes were implemented in commits b6447295fff7b38fdffc67e0df9712d60cef3cc3 and 07408cec79d1856d81bb42c74a904a24fdb9e465.","status":"published","published":"2026-09-30T14:46:04Z","modified":"2026-10-01T17:55:53.79360855Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-295","CWE-440"],"updated_at":"2026-11-02T15:46:42.077781Z"},{"id":"OESA-2026-4624","title":"python-urllib3 security update","description":"Sanity-friendly HTTP client for Python\r\n\r\nSecurity Fix(es):\n\nurllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker\u0026apos;s certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.(CVE-2026-97687)","status":"published","published":"2026-10-29T09:03:43Z","modified":"2026-10-29T09:15:41.908038761Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4625","title":"python-urllib3 security update","description":"Sanity-friendly HTTP client for Python\r\n\r\nSecurity Fix(es):\n\nurllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker\u0026apos;s certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.(CVE-2026-97687)\n\nurllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0.(CVE-2026-97689)","status":"published","published":"2026-10-29T09:03:43Z","modified":"2026-10-29T09:15:42.90923157Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4626","title":"python-urllib3 security update","description":"Sanity-friendly HTTP client for Python\r\n\r\nSecurity Fix(es):\n\nurllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker\u0026apos;s certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.(CVE-2026-97687)","status":"published","published":"2026-10-29T09:03:45Z","modified":"2026-10-29T09:15:43.210375572Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4627","title":"python-urllib3 security update","description":"Sanity-friendly HTTP client for Python\r\n\r\nSecurity Fix(es):\n\nurllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker\u0026apos;s certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.(CVE-2026-97687)","status":"published","published":"2026-10-29T09:03:45Z","modified":"2026-10-29T09:15:43.217698141Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"PYSEC-2026-4175","title":"urllib3: HTTPS proxy TLS configuration may be ignored or overridden","description":"## Impact\n\nurllib3 supports configuring TLS independently for an HTTPS proxy and the target server.\n\n`proxy_ssl_context`, `proxy_assert_hostname`, and `proxy_assert_fingerprint` configure the TLS connection to the proxy. `ssl_context` and the other target-specific TLS parameters configure the connection to the target server.\n\nIn urllib3 versions 1.26.0 through 2.7.0, these configurations were not consistently separated. Depending on the proxy mode, urllib3 could:\n\n1. Ignore `proxy_ssl_context` and use the target server's SSL context for the TLS connection to an HTTPS forwarding proxy.\n2. Override the HTTPS proxy's certificate-verification policy with the target server's certificate-verification policy.\n3. Apply target-specific SNI, hostname assertions, certificate fingerprint assertions, or TLS client credentials to the TLS connection to an HTTPS forwarding proxy.\n\nIn particular, configuring `cert_reqs=\"CERT_NONE\"` for a target server could overwrite the `verify_mode` of the SSL context configured for the HTTPS proxy. This modification occurred in place and persisted on the context object, potentially disabling proxy certificate verification for later connections that reused the same context.\n\nAn attacker able to intercept the connection to an HTTPS proxy may be able to impersonate the proxy when the effective proxy TLS configuration disables certificate verification or otherwise accepts the attacker's certificate. This may occur, for example, when the target server's trust or identity policy is incorrectly applied to the proxy connection.\n\nWhen HTTPS forwarding is enabled, an impersonated proxy can observe or modify forwarded requests and responses, potentially exposing credentials, authentication tokens, request bodies, response data, and other sensitive information.\n\nA TLS client certificate intended for the target server may also be presented to the proxy or to an attacker impersonating it. This can disclose the client's identity and provide proof of possession of the corresponding private key. The private key itself is not transmitted during the TLS handshake.\n\nIn CONNECT tunneling mode, impersonating the HTTPS proxy does not by itself defeat the separate end-to-end TLS connection between the client and the target server.\n\n## Affected Usages\n\nCode using urllib3 versions 1.26.0 through 2.7.0 may be affected in any of the following cases.\n\n### 1. The target SSL context is used for an HTTPS forwarding proxy\n\nHTTPS requests are forwarded through an HTTPS proxy with `use_forwarding_for_https=True`, and `proxy_ssl_context` is configured for the proxy.\n\nurllib3 may ignore `proxy_ssl_context` and use the target server's `ssl_context` for the proxy TLS handshake. The proxy may therefore be verified using the target server's trust and certificate policy instead of the policy explicitly configured for the proxy.\n\n### 2. The target verification policy overrides the proxy policy\n\nAn HTTPS proxy is configured with `proxy_ssl_context`, while the target server uses a different certificate-verification policy.\n\nurllib3 may apply the target server's `cert_reqs` value to the proxy SSL context. For example, setting `cert_reqs=\"CERT_NONE\"` for the target server may also disable certificate verification for the HTTPS proxy, even when `proxy_ssl_context` was configured to require verification.\n\nThis issue can affect the TLS connection to an HTTPS proxy in both forwarding and CONNECT tunneling configurations.\n\n### 3. A mutated proxy SSL context is reused\n\nThe same SSL context is reused as `proxy_ssl_context` across multiple connections, and certificate verification is disabled for one target server.\n\nurllib3 may modify the proxy SSL context's `verify_mode` in place. Later connections that reuse the same context may therefore connect to the HTTPS proxy without certificate verification.\n\n### 4. Target-specific TLS identity or credentials are applied to the proxy\n\nHTTPS requests are forwarded through an HTTPS proxy with `use_forwarding_for_https=True`, and target-specific SNI, hostname assertions, certificate fingerprint assertions, or TLS client credentials are configured.\n\nurllib3 may apply these target-specific settings to the proxy TLS handshake. This may cause urllib3 to:\n\n- send SNI intended for the target server to the proxy;\n- verify the proxy using a hostname or certificate fingerprint intended for the target server; or\n- present a TLS client certificate intended for the target server to the proxy.\n\nCode connecting through a plain HTTP proxy does not establish a TLS connection to the proxy and is not affected by this issue.\n\n## Remediation\n\nUpgrade to urllib3 2.8.0 or later.\n\nurllib3 2.8.0 independently applies the explicitly configured `proxy_ssl_context` and proxy-specific certificate assertions to the HTTPS proxy connection. Target-specific SNI, certificate assertions, and TLS client certificate parameters are no longer applied to the HTTPS proxy handshake.\n\nFor backward compatibility, when an HTTPS proxy is used with `use_forwarding_for_https=True` and `proxy_ssl_context` is not provided, urllib3 2.8.0 continues to use `ssl_context` for the TLS connection to the proxy. This configuration emits a `FutureWarning`. In urllib3 3.0, passing `ssl_context` with `use_forwarding_for_https=True` for an HTTPS proxy will raise an error. Applications should use `proxy_ssl_context` to configure TLS for an HTTPS forwarding proxy.\n\nThe fixes were implemented in commits b6447295fff7b38fdffc67e0df9712d60cef3cc3 and 07408cec79d1856d81bb42c74a904a24fdb9e465.","status":"published","published":"2026-10-01T16:38:40.937127Z","modified":"2026-10-01T17:45:18.54238751Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:57.671918Z"},{"id":"RHSA-2026:69612","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-01T10:19:19Z","modified":"2026-10-20T10:14:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:84577","title":"Red Hat Security Advisory: python3.14-urllib3 security update","status":"published","published":"2026-10-19T10:07:57Z","modified":"2026-10-20T10:17:33Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:84578","title":"Red Hat Security Advisory: python3.14-urllib3 security update","status":"published","published":"2026-10-19T10:07:58Z","modified":"2026-10-20T10:17:33Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:84577","title":"Important: python3.14-urllib3 security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser (CVE-2026-97689)\n\n* urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override (CVE-2026-97687)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-20T12:05:07.452289Z","modified":"2026-10-20T12:15:37.447134933Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:84578","title":"Important: python3.14-urllib3 security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser (CVE-2026-97689)\n\n* urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override (CVE-2026-97687)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-20T12:10:14.939262Z","modified":"2026-10-20T12:15:37.448972675Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:85929","title":"Important: python3.12-urllib3 security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser (CVE-2026-97689)\n\n* urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override (CVE-2026-97687)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-22T00:04:07.745746Z","modified":"2026-10-22T00:30:04.339377448Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:85930","title":"Important: python-urllib3 security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser (CVE-2026-97689)\n\n* urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override (CVE-2026-97687)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-03T00:09:09.175087Z","modified":"2026-11-03T00:30:02.596541787Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:54:08.19986Z"},{"id":"RLSA-2026:90494","title":"Important: python-urllib3 security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser (CVE-2026-97689)\n\n* urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override (CVE-2026-97687)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-29T12:04:42.224289Z","modified":"2026-10-29T12:30:03.180999588Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:92474","title":"Important: python3.12-urllib3 security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser (CVE-2026-97689)\n\n* urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override (CVE-2026-97687)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-30T12:01:32.049364Z","modified":"2026-10-30T12:30:02.306602054Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"UBUNTU-CVE-2026-97687","description":"urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.","status":"published","published":"2026-09-29T16:17:00Z","modified":"2026-10-17T13:01:20.11627022Z","cvss":[{"version":"4.0","score":7.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:57:48.647391Z"},{"id":"ALSA-2026:84577","title":"Important: python3.14-urllib3 security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser (CVE-2026-97689)\n  * urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override (CVE-2026-97687)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-19T00:00:00Z","modified":"2026-10-29T11:32:38.213844704Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:84578","title":"Important: python3.14-urllib3 security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser (CVE-2026-97689)\n  * urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override (CVE-2026-97687)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-19T00:00:00Z","modified":"2026-10-29T11:31:01.758441153Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:85929","title":"Important: python3.12-urllib3 security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser (CVE-2026-97689)\n  * urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override (CVE-2026-97687)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-20T00:00:00Z","modified":"2026-10-29T11:32:38.664140809Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:85930","title":"Important: python-urllib3 security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser (CVE-2026-97689)\n  * urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override (CVE-2026-97687)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-20T00:00:00Z","modified":"2026-10-29T11:31:01.233973547Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:90494","title":"Important: python-urllib3 security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser (CVE-2026-97689)\n  * urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override (CVE-2026-97687)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-26T00:00:00Z","modified":"2026-10-29T11:32:32.604695538Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:92474","title":"Important: python3.12-urllib3 security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser (CVE-2026-97689)\n  * urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override (CVE-2026-97687)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-29T00:00:00Z","modified":"2026-10-29T22:30:02.468098557Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"AZL-105651","title":"CVE-2026-97687 affecting package python-pip 24.2-10","description":"urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.","status":"published","published":"2026-09-29T16:17:18Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.09948Z"},{"id":"AZL-105663","title":"CVE-2026-97687 affecting package python-urllib3 2.0.7-6","description":"urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.","status":"published","published":"2026-09-29T16:17:18Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.09948Z"},{"id":"AZL-105678","title":"CVE-2026-97687 affecting package python-virtualenv 20.36.1-6","description":"urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.","status":"published","published":"2026-09-29T16:17:18Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.09948Z"},{"id":"AZL-105693","title":"CVE-2026-97687 affecting package python3 3.12.14-2","description":"urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.","status":"published","published":"2026-09-29T16:17:18Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.09948Z"},{"id":"AZL-105909","title":"CVE-2026-97687 affecting package tensorflow 2.16.1-11","description":"urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0.","status":"published","published":"2026-09-29T16:17:18Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.09948Z"},{"id":"CLSA-2026-1790834041","title":"TuxCare security update for urllib3 (2 CVEs)","description":"TuxCare rebuilt urllib3 to address 2 CVEs. Fixed in 2.0.7.post4+tuxcare.","status":"published","published":"2026-10-01T05:54:01Z","modified":"2026-10-15T09:48:02.314347643Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790847237","title":"TuxCare security update for urllib3 (2 CVEs)","description":"TuxCare rebuilt urllib3 to address 2 CVEs. Fixed in 1.26.20.post5+tuxcare.","status":"published","published":"2026-10-01T09:33:57Z","modified":"2026-10-15T09:48:02.390304204Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1791264856","title":"TuxCare security update for urllib3 (2 CVEs)","description":"TuxCare rebuilt urllib3 to address 2 CVEs. Fixed in 1.26.4.post6+tuxcare.","status":"published","published":"2026-10-06T05:34:16Z","modified":"2026-10-15T09:48:07.251659091Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791270635","title":"TuxCare security update for urllib3 (5 CVEs)","description":"TuxCare rebuilt urllib3 to address 5 CVEs. Fixed in 2.5.0.post2+tuxcare.","status":"published","published":"2026-10-06T07:10:35Z","modified":"2026-10-15T09:48:07.214349401Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"openSUSE-SU-2026:12044-1","title":"python313-urllib3-2.8.0-1.1 on GA media","description":"These are all security issues fixed in the python313-urllib3-2.8.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-04T00:00:00Z","modified":"2026-10-05T10:15:36.548229762Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:12119-1","title":"python313-urllib3_1-1.26.20-8.1 on GA media","description":"These are all security issues fixed in the python313-urllib3_1-1.26.20-8.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-13T00:00:00Z","modified":"2026-10-14T17:23:10.113168241Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22071-1","title":"Security update for python-urllib3","description":"This update for python-urllib3 fixes the following issues:\n\n- CVE-2026-97687: traffic interception due to possible HTTPS proxy TLS configuration override (bsc#1283908).\n- CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding (bsc#1283909).\n- CVE-2026-97689: denial of service due to unbounded memory allocation in chunk parser (bsc#1283910).\n","status":"published","published":"2026-10-09T11:45:30Z","modified":"2026-10-19T17:23:12.602314268Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:22252-1","title":"Security update for python-urllib3_1","description":"This update for python-urllib3_1 fixes the following issues:\n\n- CVE-2026-97687: traffic interception due to possible HTTPS proxy TLS configuration override (bsc#1283908).\n- CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding (bsc#1283909).\n- CVE-2026-97689: denial of service due to unbounded memory allocation in chunk parser (bsc#1283910).\n","status":"published","published":"2026-11-08T07:08:29Z","modified":"2026-11-11T17:23:13.17848571Z","updated_at":"2026-11-11T17:47:15.466074Z"},{"id":"SUSE-SU-2026:24125-1","title":"Security update for python-urllib3","description":"This update for python-urllib3 fixes the following issues:\n\n- CVE-2026-97687: traffic interception due to possible HTTPS proxy TLS configuration override (bsc#1283908).\n- CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding (bsc#1283909).\n- CVE-2026-97689: denial of service due to unbounded memory allocation in chunk parser (bsc#1283910).\n","status":"published","published":"2026-10-09T11:46:03Z","modified":"2026-10-13T17:23:11.248715407Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24217-1","title":"Security update for python-urllib3","description":"This update for python-urllib3 fixes the following issues:\n\n- CVE-2026-97687: traffic interception due to possible HTTPS proxy TLS configuration override (bsc#1283908).\n- CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding (bsc#1283909).\n- CVE-2026-97689: denial of service due to unbounded memory allocation in chunk parser (bsc#1283910).\n","status":"published","published":"2026-10-09T11:46:03Z","modified":"2026-10-21T17:23:10.647347354Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:4704-1","title":"Security update for python-urllib3","description":"This update for python-urllib3 fixes the following issues:\n\n- CVE-2026-97687: traffic interception due to possible HTTPS proxy TLS configuration override (bsc#1283908).\n- CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding (bsc#1283909).\n- CVE-2026-97689: denial of service due to unbounded memory allocation in chunk parser (bsc#1283910).\n","status":"published","published":"2026-10-16T13:31:22Z","modified":"2026-10-17T10:00:04.114494375Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4948-1","title":"Security update for python-urllib3_1","description":"This update for python-urllib3_1 fixes the following issues:\n\n- CVE-2026-97687: traffic interception due to possible HTTPS proxy TLS configuration override (bsc#1283908).\n- CVE-2026-97688: denial of service due to infinite loop during chunked Deflate decoding (bsc#1283909).\n- CVE-2026-97689: denial of service due to unbounded memory allocation in chunk parser (bsc#1283910).\n","status":"published","published":"2026-10-30T09:56:01Z","modified":"2026-11-02T17:23:10.115070089Z","updated_at":"2026-11-02T18:00:32.560004Z"},{"id":"USN-8926-1","title":"python-urllib3 vulnerabilities","description":"Yu-Fu Fu, Seth Larson and Yonatan Magier discovered that urllib3 did not\ncorrectly handle certain certificate validations. An attacker could\npossibly use this issue to observe or modify forwarded traffic. This\nissue only affected Ubuntu 26.04 LTS. (CVE-2026-97687)\n\nMartin Desrumaux discovered that urllib3 did not correctly handle\ndecoding certain deflate responses. An attacker could possibly use this\nissue to cause a denial of service. This issue only affected\nUbuntu 26.04 LTS. (CVE-2026-97688)\n\nIt was discovered that urllib3 did not correctly handle certain memory\noperations. An attacker could possibly use this issue to cause a denial\nof service. (CVE-2026-97689)","status":"published","published":"2026-10-14T06:23:09Z","modified":"2026-10-17T13:11:53.766526136Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}